With the rapid development of the Internet, a profit linker for a grey industry that aggregates website traffic based on viral modes and monetize the advertisement traffic has been formed. Every day, hundreds of malwares come out, using offensive technologies to bundle or guard mutually by means of processes, registers and files to constantly update the virus file's behavior characteristics so as to prevent an antivirus software from detecting and destructing them.
Internet virus files may currently spread through the following fashion: it uses a cloud control instruction to modify the default browser home page and search engine of a user in a machine system, modify keyword search rankings, intercept browser pop-up ads, maliciously tamper the desktop shortcut associations, install malicious plug-in software that is not needed by the user, and steal the user's private contents. A traditional antivirus software mainly searches and destroys malicious behaviors of files, and deletes the corresponding files when malicious behaviors are found. When it comes to an Internet virus file, the virus file usually cannot be completely deleted by simply performing a behavior analysis and file deletion at the client of the machine system, resulting in an inferior security of the machine systems.